This new design can read the and program virtually all commonly-used EPROMs and OTPs.

By Jim Rowe

READ-ONLY MEMORIES or "ROMs" have been used for many years to store data and "firmware"
programs in a huge range of digital equipment. So if you do servicing work on
such equipment, it's very handy to have a device which can read and check the
contents of a ROM.

These three adapter boards plug into the 32-pin ZIF socket on the main board to allow the older types of EPROMs to be programmed. These include 32Kb devices in 24-pin DIL packages and devices in 32-pin PLCC (plastic leadless chip carrier) packages with capacities from 64Kb to 2Mb.

And if you do development work on equipment with ROMs, it's
essential to be able to program them as well. You need to be able to program
EPROMs (erasable programmable ROMs) and ideally, OTP (one-time programmable)
ROMs and EEPROMs (electrically erased programmable ROMs) as well.

Although freestanding programmer/readers are available, they're
quite expensive. Even those that are controlled by a PC aren't cheap, with
prices ranging from about $300 up to over $2000. Our new comprehensive design is
much cheaper than that. We estimate that the kit cost should be around $160.

A good PC-driven programmer/reader was described in the
September and October 1993 issues of "Electronics Australia". Designed by
Dr Glenn Pure, it was very popular, with many hundreds of kits sold. It was
given a further boost in January 2000, when Glenn Pure described how to
adapt the original design for programming 1Mb (one megabit) EPROMs.

This new programmer/reader has been designed to build on the
work of Glenn Pure and it gets around most of the shortcomings of the earlier
version. It has all the circuitry on a single double-sided PC board and because
all of the setting-up and device configuration are under software control,
there's no off-board wiring. The board has one DB25 connector to accept the
cable from the PC's printer port and a socket for a 12V AC plugpack.

The controlling software is Windows-based (Win95/98), rather
than DOS-based as in the earlier design.

The programmer has one ZIF (zero insertion force) socket for
the EPROM to be programmed or read. This is a 32-pin socket which can be
configured by the software to suit devices in 28-pin or 32-pin DIL packages,
with capacities from 64Kb (kilobits) to 2Mb (megabits).

It can also be used to work with older 32Kb devices in 24-pin
DIL packages and devices in 32-pin PLCC (plastic leadless chip carrier) packages
with capacities from 64Kb to 2Mb. This is done with small matching socket
adaptors which fit into the ZIF socket.

How it works

Although there's lots more circuitry in the new programmer than
in Glenn Pure's original, the basic operation is pretty straightforward. Let's
refer to the block diagram shown in Fig.1.

As already noted, the programmer is designed to connect to the
PC via a standard parallel (Centronics) printer port. It does not need the newer
bidirectional ECP (extended capabilities port) or EPP (enhanced parallel port).
This makes it fully compatible with older PCs.

As a result of using the Centronics port, we have a total of 12
8-bit lines for 'outgoing' data from the PC to the programmer and five 8-bit
lines for 'incoming' data.

Fortunately, the majority of PROMs have their data organised in
8-bit bytes and we're also able to handle the outgoing address, configuration
and pulse timing data in (8-bit) bytes as well, so the eight data output lines
provided in a standard printer port's main 'base I/O address' are all we need,
for downloading all of this data.

As shown in Fig.1, data comes from the PC via pins 2-9 of the
DB25 connector and is fed to buffer IC1. The outputs of this buffer are then fed
to a byte-wide data bus, which goes to the EPROM programming socket and to
various storage registers.

For example, when the software wants to change the current
EPROM address, it can send down a byte representing the lowest eight address
bits for storage in the 'low address byte register' IC6; and/or it can send a
byte representing the next most significant eight address bits, for storage in
the 'mid address byte register' IC7.

Alternatively or in addition, it can send down a byte with the
two top address bits, for storage in the 'hi address bits register' IC10; or a
byte providing the configuration data for the EPROM to be programmed, for
storage in the 'EPROM config register' IC9, or a byte specifying the duration of
the programming pulses to be used, for storage in the 'PGM* pulse duration
register' IC8.

Fig.1: the programmer connects to the PC via a standard parallel (Centronics) printer port. Data comes in via pins
2-9 of the DB25 connector and is fed to buffer stage IC1. The outputs of this buffer are then fed to a byte-wide data bus, which goes to the EPROM programming socket and to various storage registers.

How does the software control which register receives this
downloaded data or whether it goes to the EPROM? That's controlled by three more
of the printer port's outgoing data lines. These are provided by bits D1-D3 of
the control register at the PC's I/O port address 'base + 2' (ie, two up from
the port's main base address). These bit lines arrive on pins 14, 16 & 17 of
the DB25 connector and are fed to the inputs of decoder IC3, where they're
decoded to provide one of eight different 'mode control' logic signals.

These signals are used to control the current operating mode of
the programmer and where the data bytes from IC1 are sent.

The 12th outgoing bit from the printer port (the least
significant bit D0 of the port's control register) arrives on pin 1 of the DB25
connector and is used to trigger the programmer's PGM* hardware pulse timing
circuit. This involves ICs 4, 13 & 14. When they're triggered, they produce
a programming pulse with a length determined by the data byte currently stored
in IC8.

All of the voltage setting and chip configuration data stored
in config register IC9 is used to control switching circuits associated with ICs
16-19. This is how the software is able to set the correct voltage levels and
pin functions for each type of EPROM and for each programming
mode.

Nibble this, nibble that

So much for programming, then. But what about reading data
already stored in an EPROM? Since a standard parallel printer port provides only
five incoming data bit lines, we simply split the data byte from the EPROM into
two four-bit 'nibbles' and send them back to the PC separately. The software
then 'glues them back together' to produce the full data byte.

During a read operation, the data byte from the EPROM's current
address appears on the data bus (the outputs of IC1 are turned off in this
mode). It's then effectively split into two nibbles by multiplexer IC2, which
presents one nibble or the other to pins 10-13 of the DB25 connector, as
controlled by a 'read low data nibble' or a 'read high data nibble' signal from
IC3.

In the PC, these pins connect to data bits D4-D7 of the port's
read-only status register at I/O address 'base +1', so this enables the software
to read each nibble separately before reassembling them into the read data
byte.

The fifth and last incoming bit line on the printer port
connects to pin 15 of the DB25 connector and this is used in the programmer to
provide a copy of the PGM* pulse, so that the software can tell when the
hardware-timed pulse has ended. This bit line also goes back to the printer
port's status register at I/O address 'base +1', specifically to that register's
bit D3.

The basic arrangement of the various registers and I/O
addresses associated with a PC's printer port is shown in
Fig.2.

Circuit description

Fig.2: this diagram shows the basic arrangement of the various registers and I/O addresses assoc-iated with a PC's printer port.

Now let's look at the main circuit, shown in Fig.3 (see
over).

The data input buffer IC1 is a 74HC245 octal bus transceiver.
This is a bidirectional device, although it's used here only for buffering in
the 'write' direction. The data bit lines from the DB25 connector are fed to its
inputs via 100Ω
stopper resistors, which minimise line reflections and ringing. (This is also
done for all other port signal lines.)

The outputs of IC1 are enabled by a logic low signal applied to
pin 19 in all of the programmer's modes, except the two for reading back EPROM
data. In these two modes, the outputs are disabled by applying a logic high
signal to pin 19, from gate IC4c.

In all other modes, IC1 receives the downloaded data from the
PC printer port's base address and passes it straight through to the
programmer's internal data bus. From here, it can be fed to any of the storage
registers or to the ZIF socket and EPROM.

The data is loaded into each storage register as desired by
applying a logic signal to its parallel load input. As mentioned earlier these
'load data' signals come from the outputs of mode decoder IC3, a 74HC138. So
when the software wants the data byte to be loaded into low address byte
register IC6 for example, it manipulates the three control bit lines feeding IC3
to force its Y0-bar output to go low.

This LAL* (Load Low Address, active low) signal is then
inverted by IC5f and fed as an active high signal to pin 11 of IC6 so that it
loads the data byte into its internal latches (ICs 6, 7, 8 & 9 are all
74HC373 octal latches).

can be set up on the DIP switches.

Similarly, the software can have the data byte loaded into mid
address byte register IC7 by manipulating the three bit lines feeding IC3, so
that the Y1-bar output goes low. The resulting LAM* signal is then inverted by
IC5a and fed as a LAM signal to pin 11 of IC7.

The data can be loaded into high address register IC10, config
register IC9 or PGM* pulse duration register IC8 in the same way. The LAH*
signal from the Y2-bar output of IC3 is used to load IC10, while the LCF* and
LPD* signals from the Y3-bar and Y6-bar outputs of IC3 are used to load IC9 and
IC8 respectively.

Also to be described next month is this simple plug-in PC board which is used to test the EPROM Programmer's read functions. The read data

The only difference with the last of these signals is that
there's a small low-pass RC filter between the Y6-bar output of IC3 and the
input of inverter IC5c (the 100Ω resistor and 1nF capacitor). This is to prevent timing
misloads due to narrow spurious glitches which can appear at the output of
IC3.

IC5 also drives five inverters in IC15, which in turn drive
LEDs 1-5. These LEDs light to indicate when data is being loaded into each of
the registers. We'll come to LED6 in a moment.

Timing circuit

ICs4, 13 & 14 form the timing circuit for the programmer's
PGM* puls-es. As you can see, IC13 and IC14 are both 74HC161 4-bit synchronous
counters, which together form an 8-bit counter. The counter's operation is
controlled by IC4a and IC4b, which form the timing control flipflop.

Inverter IC12b and crystal X1 form a 4MHz oscillator which then
drives flipflops IC11a and IC11b to give 2MHz and 1MHz clock signals. The 1MHz
pulses from pin 9 of IC11b are fed to IC13 and IC14, so they count in accurate
1μs
increments.

The 4MHz, 2MHz and 1MHz clock signals are also fed through to
three inverters in IC12 and made available at on-board test points.

The timing counter works as follows. Normally the flipflop
formed by IC4a and IC4b is reset, with pin 3 low and pin 6 high (and the latter
is also the PGM* output line, so there is no pulse). In this state, the counters
are in "parallel load" mode, with the data byte in timing register IC8 being
loaded into them.

When the software sends down a programming trigger pulse via
pin 1 of the DB25 connector, it is passed through the differentiating circuit
formed by the 100pF capacitor, 4.7kΩ resistor and diode D1. The
resulting very narrow
negative-going pulse is then applied to pin 1 of IC4, which makes the control
flipflop switch into its set or 'counting' state, with pin 3 now high and pin 6
low.

The low level on pin 6 thus forms the PGM* pulse, while the
high level on pin 3 switches counters IC13 and IC14 from parallel load mode into
counting mode. They therefore begin counting the 1MHz clock pulses, starting
from whatever binary value has been loaded into them from IC8.

This counting operation continues until IC13 and IC14 both
reach their maximum or 'terminal' count of 255 decimal (11111111 binary or FF
hex). Then the TC output of IC14 (pin 15) goes high and this signal is fed back
through inverter stage IC4c to pin 5 of IC4b, which triggers the control
flipflop back into its reset mode.

Pin 6 of the flipflop then flicks back high, ending the PGM*
pulse, while pin 3 goes low and switches the counters back to parallel load
mode.

Fig.3: the full circuit for the PC-Driven EPROM Programmer (minus the power supply). IC1 receives the downloaded data from the PC's printer port and passes it straight through to the programmer's internal data bus. From there it can be fed to any of the storage registers or to the ZIF socket and EPROM.

The bottom line is that the timing circuit can produce a PGM*
pulse anywhere between 1μs and 255μs, depending on the 'pulse duration' data byte loaded by the
software into register IC8. But note that because the counter counts UP to 255
from the value parallel loaded from IC8, the actual pulse length generated by
the circuit is given not directly by the value of the data byte but by the
difference between it and 255; ie:

Pd = (255 - Dv) microseconds

where Pd is the pulse length and Dv is the value of the
duration data byte. So to generate a 1ms pulse, the software must send down a
value of 254. Similarly, a value of 0 will produce a pulse length of
255μs. For a
50μs pulse, it
must send down a duration byte value of 205 and so on.

By the way, if you're wondering about that 10Ω resistor and 100pF
capacitor in the timing circuit's terminal count feedback line, they form
another glitch-swallowing low-pass filter. 74HC161 chips can produce a very
narrow 'false TC output' glitch pulse when they're changing state at a lower
count but the filter stops this glitch from upsetting the timing.

As well as setting the mode of counters IC13 & IC14, the
signal at pin 3 of IC4a is fed through inverter IC5d to pin 15 of the printer
port connector, so the PC software can monitor the PGM* pulse and sense when it
ends. In addition, this signal is taken to inverter IC15c, which drives
indicator LED6. This LED lights whenever a PGM* pulse is being
generated.

ZIF switching

Most of the remaining circuitry is used for switching voltages
and signal lines to various pins of the ZIF socket, to suit it to different
EPROMs and for the various programmer operating modes. This is done under
software control, mainly using the eight output lines from config register IC9.
These are labelled CF0 - CF7 and their functions are shown in Table 1.

Fig.4: power for the EPROM Programmer comes from a 12VAC plugpack. This feeds three rectifier circuits and three 3-terminal regulators to derive four supply rails: Vpp, Vcc, +5V & +16V. The software controls the actual values of Vpp & Vcc to suit different types of EPROMs.

Other signals used by the switching circuitry are the PROG*
output from mode decoder IC3 (pin 7, Y7-bar), the PGM* programming pulse from
IC4 pin 6 and the READ signal from pin 11 of IC4c.

If you have a look at IC9, the CF0 signal drives transistor Q6,
which operates relay RLY1. This controls the voltage/signal fed to pin 3 of the
ZIF socket, allowing the software to select either address line A15 or
programming voltage Vpp as required for different EPROMs.

Note that the same ZIF socket pin becomes pin 1 for 28-pin
EPROMs. That's why Table 1 shows a second pin number in brackets. This
convention is used with the other pins as well.

Similarly, the CF4 signal drives Q7 and relay RLY2, which
controls the voltage/signal fed to pin 30(28) of the ZIF socket. In this case
the software can select either address line A17 or Vcc, as required.

Signals CF1, CF2 and CF3 are also used to control ZIF socket
pin voltages/signals, except that transistors and gates are used for the
switching rather than relays. This is because this switching needs to be done
relatively quickly, in conjunction with the PGM* pulses. These switching
functions involve IC17-IC19, transistors Q4-5 and Q8-Q15 and diodes
D8-D11.

Power supply

Referring back to Table 1, you can see that the remaining
control signals from config register IC9 (CF5˜F7) are used to switch the values
of chip supply voltages Vcc and Vpp, to suit the needs of different EPROMs in
either read or write mode. To see how this switching is done, refer to the power
supply circuit in Fig.4.

The programmer derives all its operating voltages from a
standard 12VAC 1A plugpack, which connects via CON2. The 12VAC feeds three
rectifier circuits, to provide a total of four different supply lines.

Diode D5 and a 2200μF filter capacitor provide the
unregulated +16V line used to operate the two relays.

Diode D2 is also used as a halfwave rectifier, with another
2200μF reservoir
capacitor. This feeds regulators REG1 and REG2. REG1 is a fixed type (7805)
which provides the +5V supply line for all of the programmer's own logic chips
and indicator LEDs (including power indicator LED7). REG2 is an adjustable type
(LM317) and is used to provide the EPROM's programmable Vcc supply line.

Control signals CF5 and CF6 are used here, in conjunction with
the programming mode control signal PROG* (from mode decoder IC3, pin 7). These
are fed to logic gates from IC16 and inverters from IC17, to control transistors
Q1 and Q2. The two transistors switch in resistor combinations across the lower
resistors in REG2's voltage setting divider, to control its output voltage
Vcc.

Table 2: this table shows the range of EPROMs and OTPs that the new programmer can handle. Just about all common types are catered for, ranging from 32Kb 24-pin units to 2048Kb 32-pin DIP PLCC types.

As a result, the software can select the Vcc voltage fed to the
EPROM socket pins - either 3.0V, 5.0V or 6.25V, - as needed for different EPROMs
in either read or write mode.

The actual voltages produced by REG2 are about 0.7V higher than
these nominal voltage figures, to allow for the voltage drop in the associated
switching transistors and diodes. This means that the correct voltages are
delivered at the ZIF socket pins, when an EPROM is present.

The final rectifier circuit is the voltage doubler using diodes
D3 & D4 and 2200μF and 470μF electrolytic capacitors. This produces an unregulated output of about
+33V which is used to feed regulator REG3, another LM317 adjustable type.

Regulator REG3 is used to produce the EPROM's Vpp supply line
and as before it has resistors switched across the lower resistors of its
voltage setting divider, to control its output voltage as needed for different
EPROMs. In this case, control signal CF7 is used to switch transistor Q3, which
allows the Vpp line voltage to be switched between +21.2V and +12.95V. These
values allow for 0.2V drop in the following switching transistors, to give the
correct Vpp voltage levels of 21.0V and 12.75V at the ZIF socket pins.

So that's a fairly complete rundown on the circuitry in our new
EPROM programmer/reader. Next month, we'll cover construction and software
details.

Acknowledgements

Our thanks to Glenn Pure for his suggestions and advice. Thanks
also to Bill de Rose at Dick Smith Electronics and Bob Barnes of RCS Design.

Programming & Erasing EPROMs

Not too sure about EPROMs and how they work? Basically they're
non-volatile memory devices, which means they can store digital data for long
periods when no power is applied - until it's intentionally 'erased'. This makes
them ideal for storing 'firmware' programs for microcomputers and
microcontrollers and also for storing other data like lookup tables, graphics
characters and computer BIOS routines.

The most common type of EPROM uses a single MOS transistor for
each storage cell, with one such cell needed to store every bit (binary digit)
of data in the EPROM. So a 256K-bit EPROM will have 262,144 MOS transistor cells - one for each bit.

Each transistor cell is very much like a normal depletion-mode
MOSFET transistor, except that it contains a second inner gate electrode,
separated from the source-drain channel in the silicon chip itself by a very
thin (about 10nm) layer of silicon oxide. There's no electrical connection to
this gate, which is therefore called a 'floating' gate.

Fig.5 shows a single EPROM cell.

When an EPROM is manufactured, the floating gate of each cell
transistor has no electrical charge and as a result each channel can easily
conduct electrons between source and drain. That's why a blank or erased EPROM
effectively has a '1' stored in every memory cell.

For programming, a higher than normal voltage Vpp is applied to
the drains of the transistors for a brief period and a positive '1' voltage is
applied to the upper gate of each transistor to be programmed with a '0'. This
produces a high field strength in those transistors and a fairly high current
pulse flows through the channel. Some of the conduction electrons are
sufficiently 'excited' that some of them tunnel up through the thin layer of
insulating oxide and reach the floating gate.

Once there they cannot easily escape and as a result this gate
becomes negatively-charged. When the transistor cell is 'read' with a normal
voltage Vcc applied to the drain, the negative charge on the floating gate
prevents conduction in the channel - so that cell is now said to be programmed
with '0' rather than the original '1'. And since the charge on each floating

Fig.5: the basic structure of a single EPROM storage cell. A single MOS transistor is used for each cell, with each cell used to store one bit (ie, one binary digit). Note that there is no connection to Gate1.

gate remains there indefinitely, the programming is non-volatile, ie, loss of
supply voltage does not lose the data.

What about erasing? Well, the most common type of EPROM is
housed in a package with a transparent quartz window directly above the chip.
This allows the data to be erased by subjecting the EPROM to fairly intense
(about 12mW/sq cm) ultraviolet (UV) radiation for about 45-60 minutes. The high
energy UV photons then excite the electrons in the floating gates, so they
tunnel back through the thin oxide layer and return to the silicon chip. At the
end of this erasing operation all floating gates on the chip are left uncharged
and every memory cell contains a '1' again.

Of course, there are other methods of erasure such as in the
EEPROM (electrically erased PROM). Here the erasing is performed on each cell or
group of cells separately, by applying a relatively high negative voltage to the
upper gates at the same time as the higher positive Vpp voltage is applied to
the drains. This creates a high electric field through the floating gate,
pushing the captive charge electrons back through the thin oxide layer and into
the silicon.

This electrical erasure process is much faster than the UV
radiation method and can be used to erase just some of the EEPROM's cells,
without disturbing the data stored in the remaining cells.

'Flash' EPROMs are similar to EEPROMs but the transistor gate
structure is modified to allow easier electrical erasure. This allows the charge
to be removed from the floating gates without UV radiation or the application of
a relatively high programming/erasing voltage.